ModLogAn Splitby Input Validation Vulnerability
BID:3821
Info
ModLogAn Splitby Input Validation Vulnerability
| Bugtraq ID: | 3821 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 04 2002 12:00AM |
| Updated: | Jan 04 2002 12:00AM |
| Credit: | This vunerability was originally announced by the vendor on January 4th, 2002. |
| Vulnerable: |
ModLogAn ModLogAn 0.7.11 ModLogAn ModLogAn 0.6 ModLogAn ModLogAn 0.5.7 ModLogAn ModLogAn 0.5.6 ModLogAn ModLogAn 0.5 |
| Not Vulnerable: |
ModLogAn ModLogAn 0.7.12 |
Discussion
ModLogAn Splitby Input Validation Vulnerability
ModLogAn is a freely available, open-source log file analyzer. It can process log files from a number of different services including webservers (Apache, MS IIS, Netscape), FTP servers (wu-ftpd, proftpd, etc.) and mail servers (sendmail, qmail), and a variety of other sources. ModLogAn can be run on many Unix and Linux variants, as well as Microsoft Windows NT/2000 systems.
A vulnerability exists in the splitby option of the processor_web plugin, and should only affect systems which have this feature enabled. It may allow a local attacker to overwrite root-owned files via symlink attacks.
The splitby function enables a user to split logfiles into seperate reports per each virtual host. Splitby does not adequately validate input.
When attempting to parse a log entry that has a hostname that starts with dot-dot slash (../) sequences, it is possible that the ModLogAn output may end up in an unexpected directory of the attacker's choosing. Vulnerable versions of ModLogAn run as root. A malicious local user may capitalize on this opportunity to use symlink attacks to overwrite root-owned files. This may enable the local attacker to destroy critical data, cause a denial of services, or possibly escalate privileges.
It should be noted exploitation of this issue may depend on external vulnerabilities in server products. Like for example, BugTraq ID 3596 "Apache Split-Logfile File Append Vulnerability", as an attacker must have a way to append malicious data to the log files that ModLogAn parses. The type of log files ModLogAn parses would not normally be alterable by unprivileged users.
ModLogAn is a freely available, open-source log file analyzer. It can process log files from a number of different services including webservers (Apache, MS IIS, Netscape), FTP servers (wu-ftpd, proftpd, etc.) and mail servers (sendmail, qmail), and a variety of other sources. ModLogAn can be run on many Unix and Linux variants, as well as Microsoft Windows NT/2000 systems.
A vulnerability exists in the splitby option of the processor_web plugin, and should only affect systems which have this feature enabled. It may allow a local attacker to overwrite root-owned files via symlink attacks.
The splitby function enables a user to split logfiles into seperate reports per each virtual host. Splitby does not adequately validate input.
When attempting to parse a log entry that has a hostname that starts with dot-dot slash (../) sequences, it is possible that the ModLogAn output may end up in an unexpected directory of the attacker's choosing. Vulnerable versions of ModLogAn run as root. A malicious local user may capitalize on this opportunity to use symlink attacks to overwrite root-owned files. This may enable the local attacker to destroy critical data, cause a denial of services, or possibly escalate privileges.
It should be noted exploitation of this issue may depend on external vulnerabilities in server products. Like for example, BugTraq ID 3596 "Apache Split-Logfile File Append Vulnerability", as an attacker must have a way to append malicious data to the log files that ModLogAn parses. The type of log files ModLogAn parses would not normally be alterable by unprivileged users.
Exploit / POC
ModLogAn Splitby Input Validation Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
ModLogAn Splitby Input Validation Vulnerability
Solution:
The vendor has released an upgrade which addresses this issue. Users are also advised to investigate the fix information for BugTraq ID 3596 "Apache Split-Logfile File Append Vulnerability", since exploitation of this issue is conditional upon other vulnerabilities.
ModLogAn ModLogAn 0.5
ModLogAn ModLogAn 0.5.6
ModLogAn ModLogAn 0.5.7
ModLogAn ModLogAn 0.6
ModLogAn ModLogAn 0.7.11
Solution:
The vendor has released an upgrade which addresses this issue. Users are also advised to investigate the fix information for BugTraq ID 3596 "Apache Split-Logfile File Append Vulnerability", since exploitation of this issue is conditional upon other vulnerabilities.
ModLogAn ModLogAn 0.5
-
ModLogAn modlogan-0.7.12.tar.gz
http://telia.dl.sourceforge.net/modlogan/modlogan-0.7.12.tar.gz
ModLogAn ModLogAn 0.5.6
-
ModLogAn modlogan-0.7.12.tar.gz
http://telia.dl.sourceforge.net/modlogan/modlogan-0.7.12.tar.gz
ModLogAn ModLogAn 0.5.7
-
ModLogAn modlogan-0.7.12.tar.gz
http://telia.dl.sourceforge.net/modlogan/modlogan-0.7.12.tar.gz
ModLogAn ModLogAn 0.6
-
ModLogAn modlogan-0.7.12.tar.gz
http://telia.dl.sourceforge.net/modlogan/modlogan-0.7.12.tar.gz
ModLogAn ModLogAn 0.7.11
-
ModLogAn modlogan-0.7.12.tar.gz
http://telia.dl.sourceforge.net/modlogan/modlogan-0.7.12.tar.gz
References
ModLogAn Splitby Input Validation Vulnerability
References:
References:
- ModLogAn Announcement (ModLogAn)
- ModLogAn Product Page (ModLogAn)